reference Rule options

taint_assume_safe_booleans

Value
true or false
Default
false
See also
taint_assume_safe_numbers

With taint_assume_safe_booleans: true, a value of boolean type is clean, even when it was computed from tainted data, as query.isEmpty() is from query.

The option applies only where Opengrep knows the type: in Java, from the declared type of a variable and from the return type of a method, including library methods such as String.isEmpty(); in Go and TypeScript, from the declared type of a variable only. In Python, the option has no effect, even with type annotations.

Examples

Booleans in Java

The rule query-logged turns the option on.

Search.yaml
rules:  - id: query-logged-default    mode: taint    pattern-sources:      - pattern: request.getParameter(...)    pattern-sinks:      - pattern: log.info(...)    message: request parameter is logged    languages: [java]    severity: WARNING  - id: query-logged    mode: taint    pattern-sources:      - pattern: request.getParameter(...)    pattern-sinks:      - pattern: log.info(...)    message: request parameter is logged    languages: [java]    severity: WARNING    options:      taint_assume_safe_booleans: true
Search.java
class Search {  void handle() {    String query = request.getParameter("q");    // ruleid: query-logged-default, query-logged    log.info(query.trim());    // ruleid: query-logged-default    log.info(query.isEmpty());    boolean valid = isValid(query);    // ruleid: query-logged-default    log.info(valid);  }  boolean isValid(String q) { return true; }}
Command and result
$ opengrep test .
2/2: ✓ All tests passed
No tests for fixes found.

No effect in Python

flags.yaml
rules:  - id: flag-logged    mode: taint    pattern-sources:      - pattern: input(...)    pattern-sinks:      - pattern: log(...)    message: user input is logged    languages: [python]    severity: WARNING    options:      taint_assume_safe_booleans: true
flags.py
def is_short(s: str) -> bool:    return Truetext = input()digits: bool = text.isdigit()# ruleid: flag-loggedlog(digits)short = is_short(text)# ruleid: flag-loggedlog(short)
Command and result
$ opengrep test .
1/1: ✓ All tests passed
No tests for fixes found.